feat: Notion backend for the catalog + set command + ls/source/save UX

Persist the entry catalog to a Notion page instead of an external script.

- `hel store notion:<ref>` reads the dump from stdin and writes it into a
  single code block on the page; `hel load notion:<ref>` prints it back.
  `<ref>` is a page id (UUID) or a page title (case-insensitive search).
  Token from HEL_NOTION_TOKEN. Networking lives in helcli (ureq + serde_json);
  the core lib and the wasm build are untouched. argv is dispatched before the
  REPL starts, so the subcommands never read ~/.helrc or prompt for a master.

- `set <key> <value>`: runtime config (e.g. hel_dump, hel_notion_token) from
  ~/.helrc instead of env vars. The map is exported (uppercased) into spawned
  pipe/source children, so `set hel_notion_token ...` reaches `hel store`.
  Values are redacted in history.

- `ls` now matches case-insensitively.
- `source` echoes `source <target>`.
- `save` prints a `< removed` / `> added` diff against the last load/save
  snapshot so removals are noticed before they persist.

hel/src/lk.rs

@@ -12,6 +12,9 @@ pub struct LK {
     pub db: HashMap<Name, PasswordRef>,
     pub ls: HashMap<String, PasswordRef>,
     pub secrets: HashMap<Name, String>,
+    /// Serialized dump as of the last load (`source`) or save (`dump`). Used to
+    /// show a `< removed` / `> added` diff on save so removals are noticed.
+    pub last_dump: Option<String>,
 }
 
 impl LK {
@@ -20,6 +23,7 @@ impl LK {
             db: HashMap::new(),
             ls: HashMap::new(),
             secrets: HashMap::new(),
+            last_dump: None,
         }
     }